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(54) Passive response communication system 

(57) A method of passive response communication, 
especially for an access control system, in which a first 
transponder (2) transmits an interrogation signal to a re- 
mote second transponder (3), which responds by trans- 
mitting data back to the first transponder (2), the two 
transponders each comprising a transmitter and a re- 
ceiver, and a communication signal exchanged between 
said transponders (2, 3) in at least one direction includ- 



ing a plurality of anti -re I ay-attack pulses (13, 14). At 
least one distinguishing pulse (14) selected among the 
anti-relay-attack pulses has a distinctive shape and the 
receiver of said communication signal is selectively re- 
sponsive to the shapes of said plurality of pulses (13, 
14). Interception of the transmitted signal in a relay at- 
tack using digital transceivers will not relay the distinc- 
tive shape and the response of the second transponder 
is inhibited. 
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access control system in attempted fraudulent use 
as in Figure 2, 

Figure 5 is a schematic diagram of one embodiment 
of a transmitter in a base station in the system of 
Figure 1, . . . . 

Figure 6 is a diagram of signals generated by the 
base station transmitter of Figure 5, 

Figure 7 is a schematic diagram of another embod- 
iment of the transmitter in the base station in the 
system of Figure 1 , 

Figure 8 is a diagram of signals generated by the 
base station transmitter of Figure 7, and 

Figure 9 is a schematic diagram of a receiver in a 
portable transponder device in the access control 
system of Figure 1 . 

Detailed description of the preferred embodiments 

[001 0] The embodiment of the invention shown in Fig- 
ure 1 is an access control system forcontrolling physical 
access to a vehicle 1 and comprising a base station 2 
installed in the vehicle and a portable transponder de- 
vice 3 that is carried by the user 4 and preferably is in- 
tegrated into a physical key. The physical key is usable 
for unlocking the vehicle, for example in the case of ab- 
sence of electrical power or for actuating a physical im- 
mobiiiser on the steering column. 
[0011] The access control system is of the "RKE" - 
remote key entry - type, that is to say that the base sta- 
tion 2 controls the unlocking of locks 5 on the doors and 
other openings of the vehicle 1 by electrical actuators 
(not shown) in response to reception of a coded identi- 
fication signal from the transponder device 2. In alterna- 
tive embodiments of the present invention, the access 
control system-controls disabling of vehicle immobiliser 
functions instead of, or in addition to, controlling physi- 
cal entry into the vehicle. The control unit 2 is preferably 
also connected to actuate briefly lights 6 of the vehicle 
to confirm performance of the locking and unlocking op- 
erations of. the vehicle 1 . 

[0012] . The control unit 2 comprises a transmitter that 
will be described in more detail below, operating in the 
"LF" low frequency range, preferably at 125kHz, the 
transmitting antenna 7 being driven to transmit the H 
field, whose transmitting range is more "easily controlla- 
ble. The base station control unit 2 also includes a re- 
ceiver (not shown) for receiving signals in the UHF 
range from the portable transponder 3. The portable 
transponder 3 includes an LF receiver that will be de- 
scribed in more detail below and a UHF transmitter (not 
shown). 

[0013] For the purposes of locking the-vehicle 1 , the 
portable transponder device 3' includes a push-button 



(not shown) that may be actuated by the user 4 to trans- 
mit a signal over the UHF link to the base station control 
unit 2 to command locking of the car. Locking of the car 
is therefore performed using an active corfimunication' 
5 method. 

[0014] For unlocking the vehicle, the base station unit 
2 and the portable transponder device 3 normally' com- 
municate by a passive response communication meth- 
od, although the push-button of the portable transpond- 
er device 3 may alternatively be used to trigger unlock- 
ing of the vehicle, for example from a distance beyond 
the range of the passive communication. 
[0015] For passive communication, the access con- 
trol system includes sensors (not shown) coupled to the 
door handles 5 of the vehicle and connected to the base 
station control unit 2 so that, when the user 4 pulls a 
door handle to open a door of the vehicle 1 , a signal is 
sent from the corresponding sensor to the base station 
control unit 2. The base station control unit 2 responds 
to this signal by interrogating the portable transponder 
device 3, sending, for example, a wake-up signal fol- 
lowed by an interrogation signal, including an encrypted 
random or pseudo-random number and a base station 
identification code, followed by an anti-relay-attack field 
in accordance with this embodiment of the present in- 
vention. 

[001 6] In an alternative embodiment of the present in- 
vention, it is not necessary for the user 4 to actuate the 
door handle 5 to unlock the door. The base station 2 
repeatedly transmits the interrogation signal and re- 
sponds to the arrival of the user 4 within range of the LF 
transmitter and the corresponding reception of the user 
identification from the portable transponder device 3 to 
unlock the doors. In this embodiment of the invention, 
even the locking of the doors does not require any spe- 
cific action by the user: the base station is connected to 
sensors (not shown) that respond to the opening and 
subsequent closure of the doors to transmit the interro- 
gation signal repeatedly. The portable transponder de- 
vice 3 responds as long as the user 4 is still within range : 
of the LF transmitter and the base station 2 responds to 
the absence of the response of the portable transponder 
device 3 when the user 4 has moved out of range of the 
LF transmitter to lock the vehicle doors. The choice be- 
tween the two embodiments depends on the preferenc- 
es of the user 4. *■ ~ 

[0017] The portable transponder device 3 receives 
the interrogation signal over the LF link and checks that 
the interrogation corresponds to a valid interrogation by 
its corresponding base station. If the interrogation is val- 
id, the portable transponder device 3 responds by trans- 
mitting identification data that it has stored in a memory 
(not shown) over the UHF link to the base station control- 
unit 2, the identification data being encrypted by a suit- 
able method, preferably using the random or pseudo- 
random number transmitted by the base station control 
unit. The base station control unit 2 decrypts and checks 
the identification data transmitted by the portable trans- 
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selected as a function of a random or pseudo-random 
number at the base station control unit 2. An additional 
signal indicating the position of the modified pulse or 
pulses is encrypted and included in the anti -relay-attack 
field transmitted from the base station control unit 2 to 
the portable transponder device. The portable trans- 
ponder device 3 will inhibit response with the identifica- 
tion data unless the position of the modified falling edge 
pulses in the anti-relay-attack field corresponds to the 
position indicated by the encrypted position signal. 
[0026] The attempted fraudulent usage is shown in 
the drawings for the case of digital transmitters and re- 
ceivers. It would be difficult for relays using an analogue 
transmission link to be used. If the relays have high Q- 
factor, a substantial delay will be added to the transmis- 
sions and can be detected by the base station checking 
an acknowledge signal which is transmitted back by the 
portable transponder device. Analogue relays with a low 
Q-factorare particularly difficult to implement. 
[0027] Figure 5 shows a preferred embodiment of a 
transmitter in the base station control unit 2. The trans- 
mitter includes an antenna driver amplifier 27 that re- 
ceives the LF pulsed signal to be transmitted. The am- 
plifier 27 drives a tuned circuit comprising the transmit 
LF antenna 28 and a tuning capacitor 29 through a high 
resistance 30 of value R1 . A switch 31 is connected in 
series with a resistance 32 of considerably lower value 
R2 than the resistance R1, the series combination of 
switch 31 and resistance 32 being connected to shunt 
the resistance 30 when the switch 31 is closed. A mi- 
croprocessor 33 generates the interrogation signals in- 
cluding the anti-relay-attack field and applies the LF sig- 
nals to be transmitted to the input of the antenna driver 
27, selects one or more distinctive pulses 1 4 and applies 
a command signal to close the switch 31 temporarily 
during a few LF cycles at the falling edge of the selected 
distinguishing pulse or pulses 14. 
[0028] Referring now to Figure 6, the LF driver input 
- signal is shown at 34 for an anti-relay-attack pulse 14, 
^ .... the switch 33 closing at the falling edge of the distinctive 
pulse 1 4 as shown at 35, the LF magnetic field transmit- 
ted decaying thereafter rapidly, as shown at 36. 
[0029] An alternative embodiment of the transmitter 
of the base station control unit 2 is shown in Figure 7. 
• Once again, the antenna driver amplifier 27 supplies the 
- tuned circuit of antenna 28 and capacitor 29 through re- 
sistance 30. As shown in Figure 8, in this case the mi- 
croprocessor 33 inverts the phase of the driver signal 
34 applied to the input of the amplifier 27 temporarily 
during a few LF cycles after the falling edge 37 of the 
• distinctive pulse 14, shown at 38. The transmitted LF 
field then decays rapidly as shown at 39. 
[0030] A preferred embodiment of the receiver at the 
portable transponder device 3 is shown in Figure 9. An 
LF tuned circuit comprising a receive antenna 40 and 
tuning capacitor 41 in parallel is connected to the input 
of a receiver amplifier 42. The signal from amplifier 42 
is fed to an envelope detector 43, which has an output 



connected to a peak & threshold calculator 44 that 
measures the peak value of each pulse and calculates 
threshold definition values at 75%, 50% and 25% of the 
peak value. Another output of the envelope detector 43 

5 is connected to a data recovery comparator 45 whose 
other input is connected to the 50% output of the peak 
& threshold calculator 44/ v . ". 

[0031] The receiver also comprises first and second 
threshold comparators 46 and 47 each having an input 

10 connected to the output of the envelope detector 43. The 
first threshold comparator 46 is also connected to the 
25% output of the peak & threshold calculator 44 to pro- 
vide a binary output when the output of the envelope 
detector 43 falls below (or rises above, in the case of a 

15 rising edge of a pulse) 25% of its peak value and the 
second threshold comparator 47 is connected to the 
75% output of the peak & threshold calculator 44 to pro- 
vide a binary output when the output of the envelope 
detector 43 falls below 75% of its peak value(or rises 

20 above, in the case of a rising edge of a pulse). The binary 
outputs from the threshold comparators 46 and 47 are 
supplied to an anti-relay-attack control unit 48 that 
measures the time that elapses between the binary sig- 
nals from the second comparator 47 and the first com- 

25 parator 46, for example by counting the number of clock 
pulses between these two events. 
[0032] It would be possible for the receiver of the anti- 
relay-attack signals to respond to the absolute values of 
the fall times of the successive pulses. However it is pre- 

30 ferred that the portable transponder device 3 responds 
to the difference between the rise and fall times of the 
anti-relay-attack signals pulses. More specifically, in the 
preferred embodiment of the invention, if dT is the dif- 
ference between the rise and fall time of a pulse, it is 

35 preferred for the portable transponder unit to check the 
validity of the interrogation by comparing dT for one anti- 
relay-attack pulse with dT for another anti-relay-attack 
pulse. Thus, the number of clock pulses between the 
75% and 25% levels of the received anti-relay-attack . 

40 pulses will be subtracted for the rise and fall edges of a 
given anti-relay-attack pulse and the result of the sub- 
traction compared between different anti- re lay-attack 
pulses. Hence, in responding to the distinctive shape of 
the anti -re I ay-attack pulse or pulses selected by the 

45 base station control unit 2, the portable transponder de- 
vice 3 responds to the rate of change of the edges of 
the received pulses and, more specifically, to the differ- 
ence in the rate of change of the rising and falling edges 
of the anti-relay-attack signals. In particular it preferably 

so responds to the variations between the distinguishing 
pulse and the other anti- re lay- attack pulses. These' 
rates of change are sensed by responding to the time 
elapsed between the moment that an edge reaches a 
first value and the moment that it reaches a second val- 

55 ue, in the present embodiment the first and second val- 
ues being the 25% and 75% values. 
[0033] It will be appreciated that the embodiments of 
the present invention described offer an enhanced se- 
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response to receipt of said data from said second 
. „ . transponder. 

15. A portable device for an access control system as 
claimed in claim 1 2 or 1 3 and comprising said sec- 5 
ond transponder (3) and means for storing said da- 
ta. ~ r -" r 

1. A method of passive response communication in 
which a first transponder (2) transmits an interroga- 10 
tion signal to a remote second transponder (3), 
which responds by transmitting data back to the first 
transponder (2), the two transponders each com- 
prising a transmitter and a receiver, and a commu- 
nication signal exchanged between said transpond- is 
ers {2, 3) in at least one direction including a plurality 

of pulses (13,14), 

characterised in that at least one edge of at least 
one distinguishing pulse (14) selected among said 
plurality of pulses has a rate of change different 20 
from the rate of change of a corresponding edge of 
at least another of said plurality of pulses so as to 
confer so as to confer a distinctive shape on said 
distinguishing pulse (1 4) and the receiver (Fig. 9) of 
said communication signal is selectively responsive 25 
' to the shapes of said plurality of pulses (13, 14). 

2. A method as claimed in claim 1 , wherein the receiv- 
er (Fig. 9) of said communication signal is respon- 
sive to the time elapsed between the moment that 30 
said edge reaches a first value and the moment that 
said edge reaches a second value. 

3. A method as claimed in claim 1 or 2, wherein said 
receiver (Fig. 9) is selectively responsive to relative 35 
values of both rise rate of change and fall rate of 
change of said plurality of pulses (13, 14). 

4. A method as claimed in any preceding claim, where- 
in said receiver (Fig. 9) is selectively responsive to 40 

relative values related to the respective shapes of 
said at least one distinguishing pulse (14) and at 
least one other pulse (13) among said plurality of 
» said pulses. 

V " : v rt ' 45 
5r -A method as claimed in claims 3 and 4, wherein said 
receiver (Fig. 9) is selectively responsive to relative 
values of the respective differences between the 
rise time and fall time of said plurality of pulses (13, 
14). • 50 

■ ...6. A method as claimed in any preceding claim, where- 

in said at least one distinguishing pulse (14) is se- 
lected randomly or pseudo-randomly at the trans- 
mitter (Fig. 5, Fig. 7) of said communication signal 55 
. : . -. and said communication signal includes an indica- 
tion of which pulse is said at least one distinguishing 
pulse (14), the receiver (Fig. 9) of said communica- 



tion signal being selectively responsive to the shape 
of a pulse corresponding to said indication. 

7. A method as claimed in any preceding claim, where- 
in said communication signal is an electromagnetic 

- signal and the transmitter (Fig.- 5, Fig. 7) of said 
communication signal includes"a'tuned circuit (28, 
-29, 30) having a first quality factor and a resistive 
element (32) that is selectively connected with said 
tuned circuit (28, 29 ; 30) whereby to modify said 
quality factor and differentiate the shapes of said 
plurality of pulses. 

8. A method as claimed in claim 7, wherein the fall time 
of said at least one distinguishing pulse (14) is 
shorter than the fall times of the others (1 3) of said 
plurality of pulses and said resistive element (32) is 
selectively connected with said tuned circuit (28, 29, 
30) so as to reduce said quality factor at the falling 
edge of said at least one distinguishing pulse (14). 

9. A method as claimed in any of claims 1 to 6, wherein 
the fall time of said at least one distinguishing pulse 
(14) is shorter than the fall times of the others (13) 
of said plurality of pulses and the transmitter (Fig. 
7) of said communication signal includes means 
(33) for inverting the phase of the signal transmitted 
so as to reduce the fall time of said at least one dis- 
tinguishing pulse (14). 

1 0. A method as claimed in any preceding claim where- 
in said interrogation signal is a signal (34) of rela- 
tively low frequency and the signal transmitted back 
to said first transponder (2) is a signal of relatively 
high frequency. 

11. A method of access control comprising communi- 
cation between first and second transponders (2, 3) 
by a method as claimed in any preceding claim, and 
selectively enabling access in response to said dis- 
tinctive shape of said distinguishing pulse (14). 

12. An access 'controf system for controlling access by 
a method including passive response communica- 
tion as claimed in any preceding claim, comprising 

- - a base station .(2).including said first transponder 
and a portable device (3) including said second 
transponder, said base station (2) being selectively 
responsive to reception of said data from said sec- 
ond transponder (3)' to enable access." " 

An access control system as claimed in claim 11, 
wherein said communication signal is transmitted 
..with said at least on distinguishing pulse (1 4) from 
said base station (2) to said portable device (3) and 
said portable device (3) is selectively responsive to 
the shapes of said plurality of pulses (13, 14) to 
send said data to said base station (2). 
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